[Herklos]

Summary

• Add a root ruff.toml for the Python packages. It targets py311 and enables only the E4, E7, E9 and F rule groups. Tests and examples/ are excluded.
• Add a lint job to .github/workflows/publish-python.yml. It runs on pull requests and on pushes to master, uses Python 3.12, and runs ruff pinned to 0.17.0 over packages/python.
• The ruff step uses continue-on-error: true, so the job reports findings without failing the check. The job does not appear in the needs of any publish job, so it does not gate publishing.
• Remove the # noqa: F821 on the ExceptionGroup raise in mirror_channel.py. ExceptionGroup is a builtin on Python 3.11 and later, so the comment suppressed nothing.

Notes

• The current tree has 60 ruff findings (48 unused imports, 6 late imports, 3 unused variables, 3 f-strings without placeholders). Fixing them is out of scope for this PR and will come in a follow-up.
• No dependency files or lockfiles changed. Ruff is pinned in the workflow only.
• The test matrix is unchanged.